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distributed 
nodes to 
collect traffic 
statistics at 
distributed 
points in the 
network. These 
statistics are 
forwarded to 
collectors 
which compile 
the statistics to 
create 
combined 
views of 
network 
performance. A 
collector may 
mimic a prior 
art, non- 
distributed, 
network probe 
and may 
interact with 
network 
management 
software as 
though it were 
a stand alone 
network probe 
thereby 
simplifying a 
user's 

interaction with 
the distributed 
system. The 
invention is 
designed to 
work in 
accordance 



Claims 

What is claimed is: 

1 . A method for distributed collecting of network statistics 
comprising: 

gathering network statistics at a plurality of nodes distributed 
in a network; 

transmitting data containing said statistics to a collector; 
combining said statistics from said plurality of nodes into 
group network statistics to form complied statistics; 
reporting network performance data based on said compiled 
statistics, from said collector, to a network manager; and 
wherein multiple nodes each respond to a multicast poll data 
unit from a collector and flooding of the collector is prevented 
by having each node delay its response by a random value. 

2. The method according to claim 1 further comprising: 

setting values at said collector to configure said collecting of 

network statistics; and 

forwarding configuration data by said collector to said nodes 
to configure said gathering by said nodes. 

3. The method according to claim 1 further comprising: 

launching an agent in nodes participating in said distributing 
collecting, said agent being an executable module for 
gathering network statistics and communicating with said 
collector. 

4. The method according to claim 1 wherein said compiled 
statistics are as defined in a standard defined for the gathering 
of network-wide performance statistics. 

5. The method according to claim 1 further comprising: 

capturing network data streams at said nodes; and 
forwarding said captured data streams to said collector. 

6. The method according to claim 4 wherein said compiled 
statistics are as defined by published RMON or RM0N2 
monitoring protocols. 

7. The method according to claim 1 wherein a plurality of said 
nodes are end systems that provide network communications 
to a user. 

8. The method according to claim 1 wherein a plurality of said 
nodes communicate using an ethernet protocol. 
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with a variety 
of standard 
network 
management 
protocols 
including 
SNMP, RMON, 
and RM0N2 
but is not 
limited to those 
environments. 
The invention 
has 

applications in 
a variety of 
communication 
system 
environments 
Including local 
area networks, 
cable television 
distribution 
systems, ATM 
systems, and 
advanced 
telephony 
systems. A 
specific 

embodiment of 
the invention 
solves Is 
particularly 
optimized to 
work In LAN 
environments... 
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9. The method according to claim 1 wherein said collector 
communicates with said network manager using a first protocol, 
said first protocol being a higher layer protocol defined for the 
monitoring and management of networks and wherein said 
node communicates with said collector using a second 
protocol, said second protocol being a lower layer protocol that 
In unacknowledged and Is specifically designed for lower layer 
network management communication. 

10. The method according to claim 1 wherein said collector and 
said nodes communicate via a protocol In which: 

statistics data from nodes to the collector Is generated only In 
response to a poll packet received from a collector; 
poll and response packets are not acknowledged or 
retransmitted; 

nodes report all network statistics in terms of cumulative 
counters so that any failure of any poll or response packet 
does not result In erroneous data at the collector but merely 
results In a delay In the collector receiving the data. 

1 1 . The method according to claim 1 0 wherein said protocol 
further provides that node responses to a poll from a collector 
are complete In one data unit so that a received response from 
a node can be processed without depending that any other 
data unit be received. 

12. The method according to claim 1 wherein said multiple 
nodes each respond to said multicast poll data unit from said 
collector and flooding of the collector is prevented by having 
each node delay Its response by said random value, wherein 
said random value determined at each node and derived from 
an address of said node. 

13. The method according to claim 1 wherein said multiple 
nodes each repeatedly respond to repeated multicast poll data 
units from said collector and flooding of the collector Is 
prevented by having each node delay Its response by said 
random value, wherein said random value determined at each 
node and derived from an address of said node and a changing 
value such that responses to a multicast poll data unit are 
redistributed with each poll. 

14. The method according to claim 1 wherein a node and a 
collector each have embedded within them an identical 
password that is separately encrypted by different reversible 
algorithms and wherein said collector and said node unencrypt 
their identical passwords at run-time only said wherein said 
collector places said Identical password in an initial poll data 
unit and wherein said node responds to that collector only If a 
password In a poll data unit matches Its password. 

15. The method according to claim 9 wherein said first protocol 
is a standard-based SNMP protocol allowing said collector to 
communicate with standard network management applications 
and said second protocol Is a non-routed layer 2 protocol 
optimized for unacknowledged communication between a 
collector and a node. 
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